<html><head><script>functiontest()
{
if (window.layoutTestController) {
layoutTestController.dumpAsText();
layoutTestController.waitUntilDone();
}
window.crash = "crash";
delete window.crash;
if (window.navigationController)
navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()");
}
functioncontinueTestAfterNavigation()
{
print("PASS: You didn't crash");
if (window.layoutTestController)
layoutTestController.notifyDone();
}
functionprint(message) {
var paragraph = document.createElement("p");
paragraph.appendChild(document.createTextNode(message));
document.getElementById("console").appendChild(paragraph);
}
</script></head><body onload="test()"><p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p><p>This cause for this bug was that the code to save the window object's property map tried to use
the deleted property sentinel key as a normal pointer.</p><p>To run this test in Safari:</p><ol><li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li><li>You should not crash.</li></ol><p>When the automated version of this test passes, you'll see a PASS message below.
(The automated version is currently disabled because DumpRenderTree doesn't work
with the back/forward cache enabled.)</p><hr><div id="console"></div></body></html>